Which versions of akamai-sensorv1 are malicious?

The following npm versions of akamai-sensorv1 are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate akamai-sensorv1 if I installed it?

akamai-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed akamai-sensorv1 — how do I know if it already compromised me?

If akamai-sensorv1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is akamai-sensorv1 part of a known attack campaign?

Yes — akamai-sensorv1 is associated with the IN-MAL-2026-015801 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find akamai-sensorv1 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for akamai-sensorv1 (version 1.0.0).

Malicious package

akamai-sensorv1npm

Advisory published Aug 5, 2026Updated Aug 5, 2026

akamai-sensorv1 is a confirmed malicious npm package (MAL-2026-13216) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in akamai-sensorv1 (npm)

MAL-2026-13216

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall akamai-sensorv1

What this malware does

The package hides an executable payload inside a block comment in index.js using Unicode variation selectors (U+FE00–U+FE0F and U+E0100–U+E01EF). sync-metrics.js reads index.js, extracts that comment, decodes the invisible bytes via unpack(), and executes the resulting string with new Function('require', batch)(require). Extraction and execution are triggered from touch() at the top of the exported sensor() function, so any consumer that calls the advertised API runs the concealed code. In addition, config.json hardcodes a public Google Calendar ICS URL (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics); index.js fetches the ICS, parses DESCRIPTION fields, optionally base64-decodes them to a URL, appends /generate, and issues a GET whose JSON response is returned to callers. This is a dead-drop command-and-control pattern in which the next-hop endpoint is rotated by editing calendar events, defeating static URL blocklists. The lookalike name imitates Akamai's sensor product but the package is not affiliated with Akamai.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for akamai-sensorv1 (version 1.0.0).
If you installed it — respond
akamai-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If akamai-sensorv1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. akamai-sensorv1 on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015801

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks akamai-sensorv1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database